Objective for Password Policy rules
While AccountManagerPlugin does not enforce password rules in
general, there are some other ways to alter password handling.
Objective for Account Registration and Verification rules
You may require administrative approval of new accounts for the
user registration process. The ability to immediately ban
existing accounts is another, related but independed feature.
Checks to use for validating Registration requests
All checks provided by AccountManagerPlugin are enabled per
default, but some are configurable on their own.
Currently configured:
${', '.join(register_check)}
Checks like BotTrapCheck won't work at all
without additional configuration.
Required disabled component(s):
${', '.join(disabled_check)}
Select one or more checks and configure related options.
Concurrent use of multiple registration checks is encouraged.
Checks are applied in turn, so order matters. Note that some
checks are used to validate admin user actions too.
${safe_wiki_to_html(context, section.doc)}
Other Account Policy options
Objective for Account Protection rules
Passwords are often not constructed as carefully as they should
be. And even a strong passphrase could be sift out, if an
attacker is able to test millions of variants in hours, if not
seconds. Firewalls and full-featured web-servers already offer
sophisticated protection, if one can afford them, handle their
installation, configuration and maintenance.
The AccountGuard component is another option.
It is an add-on to AccountManagerPlugin's own
LoginModule and provides account protection
by discouraging brute-force login attempts.
Extend user account lock duration incrementally.
It uses logarithmic calculation with the factor as
exponent, accepting decimal numbers >= 1.
Lock time will grow for any value > 1, if the failure
happens before lock expiration. I.e. value '2' means
-
double lock time after 2nd failure,
-
four times the initial lock time after 3rd,
-
eight times as long after 4th failure, etc.
At any time after lock expiration a login failure will
just trigger a lock and set a new lock timeout, but not
extend the total lock duration.